# API keys

> Create a free developer API key in Vigilbase One to raise the Agent API rate limit, and keep it safe.

Source: https://docs.vigilbase.com/tools/developers/api-keys

A developer API key raises the [Agent API](https://docs.vigilbase.com/tools/developers/agent-api) rate limit from 10 to 30 requests a minute. Keys are free, and you create them in Vigilbase One at [one.vigilbase.com/developers](https://one.vigilbase.com/developers). You need a Vigilbase One account.

## Create a key

:::steps
1. **Open Developers.** Sign in to Vigilbase One and go to [one.vigilbase.com/developers](https://one.vigilbase.com/developers).
2. **Select Create API key.** Give the key a descriptive **Name**, for example `Local dev / CI scanner`, and select **Create key**.
3. **Copy your API key.** This is the only time the full key is shown. Store it in your password manager or CI secrets.
:::

Keys start with `vb_dev_`. Under **Your keys** you see each key's **Name**, **Prefix**, **Created** and **Last used** date, never the full key.

## Use a key

Send the key in the `Authorization` header or the `X-Api-Key` header:

```bash
curl -H "Authorization: Bearer $VIGILBASE_API_KEY" https://vigilbase.com/api/v1/agent/tools
```

Each key has the scopes `tools:read`, `tools:execute` and `badges:read`. Keys belong to your user account, not to an organization.

The scan quota of 20 scans per client IP and per target each hour is the same with or without a key.

## Revoke a key

Select **Revoke** next to the key under **Your keys**. vigilbase.com caches a verified key for up to a minute, so a revoked key can keep working for about a minute; after that, requests that use it are refused with `401`. If a key leaks, revoke it and create a new one.

> [!NOTE]
> `POST /api/v1/developer/keys` on vigilbase.com no longer creates keys. It answers `410 Gone` and points to Vigilbase One.